OpenSparrow v3.3 — Click Statistics, Production Readiness Check, and Deployment Hardening

OpenSparrow v3.3 is a stability‑focused and deployment‑focused release that brings real‑world operational visibility, a production‑readiness checklist, and a full hardening pass across environment variables and configuration defaults.

This update introduces an optional Click Statistics module, expands the Admin Health Check into a proper production‑readiness validator, and tightens deployment settings for anyone running OpenSparrow outside a local dev box. Below is a detailed breakdown of what changed, why it matters, and how it improves day‑to‑day operations.

Click Statistics

A new optional module — off by default, and off genuinely means off.
When the module disabled, no collector script is emitted, nothing is downloaded, and the endpoint returns 204 without writing even if a page stays open across a toggle‑off.

• Records who clicked what, when, on which page, and optionally the table/record in context (“Record Table And Record” can be turned off to keep entries to just user/time/element)
• Log tab: recent clicks newest‑first, filterable by element and user, with a Top Elements rollup of the 20 most‑clicked elements
• Retention: “Delete Automatically After N days” (default 90, 0 = keep forever) enforced by the notifications cron so the table doesn’t grow unbounded

Admin Health Check: Production Readiness tab

Health Check now includes a dedicated tab answering is this deployment actually production‑ready? instead of just “is the database reachable.

It validates:

• APP_ENV
• demo mode being off
• secure cookies
• HTTPS (including behind reverse proxies via X-Forwarded-Proto / CF-Visitor)
• display_errors off
• Argon2id availability
• minimum password length of 12
• API rate limiting configuration
• SESSION_SAMESITE
• trusted‑proxy‑header configuration

Existing checks were refreshed as well — minimum supported PHP version now correctly requires 8.4, matching the rest of the codebase.

Deployment hardening

A broad pass through .env.example and includes/config.php:

• every environment variable is now documented
• numeric config values are clamped to sane ranges
• APP_TIMEZONE and SESSION_SAMESITE are validated instead of trusted blindly
• new settings cover: APP_URL, STORAGE_PATH, SESSION_COOKIE_NAME, DB_SSLMODE, API rate limiting, statement/SMTP/HTTP client timeouts, session idle timeout, Argon2 tuning, and a trusted‑proxy IP list

Additional hardening:

• API throttle now fails open (instead of blocking all requests) if its state store becomes unwritable
• libpq connection‑info values are quoted
• CSP report URI restricted to same‑origin

Also in this release

• Optional first name, last name, email, and phone fields on admin user accounts (informational only — not used for login, ownership, or notifications)
• Logo and favicon refreshed; login/admin brand text sized down to match
• Large internal cleanup: PHP/JS variable names expanded from abbreviations to full words, public API endpoints moved behind typed controllers (App\Controller), and die() / exit() replaced with a typed exception hierarchy — no behavior change, but relevant if you track the codebase

Following this series?

OpenSparrow v3.2 — Per‑User Access Control, Materialized Views in RAG, and a Business Design Refresh

Websites

• https://opensparrow.org